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ABSTRACT 

Thousands of competing autonomous systems (ASes) must 
cooperate with each other to provide global Internet con- 
nectivity. These ASes encode various economic, business, 
and performance decisions in their routing policies. The cur- 
rent interdomain routing system enables ASes to express pol- 
icy using rankings that determine how each router in an AS 
orders the different routes to a destination, and filters that 
determine which routes are hidden from each neighboring 
AS. Since the Internet is composed of many independent, 
competing networks, the interdomain routing system should 
allow providers to set their rankings independently, and to 
have no constraints on allowed filters. This paper studies 
routing protocol stability under these constraints. We first 
demonstrate that certain rankings that are commonly used 
in practice may not ensure routing stability. We then prove 
that, with ranking independence and unrestricted filtering, 
guaranteeing that the routing system will converge to a sta- 
ble path assignment essentially requires ASes to rank routes 
based on AS-path lengths. Finally, we discuss the implica- 
tions of these results for the future of interdomain routing. 

1. Introduction 

The Internet's routing infrastructure is made up of thou- 
sands of independently operated networks that cooperate to 
exchange global reachability information using an interdo- 
main routing protocol, the Border Gateway Protocol, Ver- 
sion 4 (BGP) [14]. This cooperation occurs in a landscape 
where these independent networks, or Autonomous Systems 
(ASes), compete to provide Internet service. BGP facilitates 
this "competitive cooperation" by enabling network opera- 
tors to express routing policies that are consistent with de- 
sired economic, business, and performance goals. 

Ranking and filtering are two orthogonal mechanisms that 
network operators use to implement their policies. Rank- 
ing determines the route to a destination that should be used, 
given several available routes. It allows an AS the freedom 
to specify preferences over multiple candidate paths to a des- 
tination (e.g., specifying a primary and a backup path). ASes 
should be able to operate autonomously, retaining ranking 
independence; i.e., the ability to specify rankings indepen- 
dently of the rankings of other ASes. Ranking independence 
enables ASes to specify rankings without coordinating with 
one another or revealing their rankings to other ASes. 

Filtering allows an operator to selectively advertise (or ex- 
port) routes to some ASes, and hide routes from other ASes. 
Filtering allows an AS to control which neighboring ASes 




Figure 1: Instability can arise when ASes independently specify rank- 
ings [10, 16]. Each circle represents an AS. AS is the destination. The 
listing of paths beside each node denotes a ranking over paths. 

can send traffic over its infrastructure, because advertising 
routes to a neighboring AS is an implicit agreement to carry 
traffic for that AS. To empower flexible business contracts, 
an AS should always retain autonomy over its decision to 
advertise routes to its neighbors; i.e., the routing protocol 
should not mandate any filtering restrictions. 

The combination of ranking independence and unre- 
stricted filtering forms the cornerstone of interdomain rout- 
ing, and has, in large part, been the reason for the success of 
BGP over the past decade. However, the ability to specify 
highly expressive policies comes at considerable cost to sys- 
tem robustness: as has been observed by Varadhan et al.and 
Griffin et al., among others, if ASes are not subject to any 
constraints on the rankings that they can specify, BGP may 
oscillate forever [10, 16]. 

Example 1 Consider Figure 1 [10, 16]. ASes 1, 2, and 3 each 
prefer the indirect path through their neighboring AS in the 
clockwise direction over the direct path to the destination, 0. 
All other paths are filtered. This configuration has no stable 
path assignment {i.e., a path assignment from which no node 
would deviate). For example, consider the path assignment 
(10, 210, 30); in this case, AS 1 has a better path available 
to it, 130, so it switches paths. This switch causes the path 
(210) to break, causing AS 2 to switch to its second choice, 
path (20). The resulting path assignment, (130, 20, 30), is a 
permutation of the original path assignment: this time, AS 
3 has the path 320 available, so it switches. This oscillation 
continues forever. ■ 

In light of this discovery, a natural question to ask is: 
"What are the necessary and sufficient conditions that guar- 
antee global routing stability?" This question is rather broad, 
because these conditions depend on various modeling deci- 
sions: the details of the routing protocol, restrictions on fil- 
tering, and whether ASes retain policy independence. This 
paper studies how the rankings allowed by a routing pro- 
tocol must be restricted to guarantee global routing stabil- 
ity, assuming that ASes (1) retain ranking independence and 



(2) face no restrictions on filtering. This question is impor- 
tant for two reasons. First, both ranking independence and 
unrestricted filtering reflect realities of how ASes specify 
policies today. Second, answering this question will deepen 
our understanding of stability of policy-based routing proto- 
cols, complementing earlier results by Varadhan et al. [16], 
Griffin et al. [10], and Gao and Rexford [6] (Section 2). 

This paper makes three main contributions. First, in Sec- 
tion 4.1, we show that rankings based solely on the immedi- 
ate next-hop AS en route to the destination may never reach 
a stable path assignment from an arbitrary initial state; i.e., 
next-hop rankings, which are common in practice, are not 
safe. Moreover, under unrestricted filtering, a routing system 
with next-hop rankings may have no stable path assignment. 
In addition to their operational implications, these results are 
also somewhat surprising, because next-hop rankings with 
no route filtering always have one stable path assignment [4]. 
We also observe that although rankings based on a globally 
consistent weighting of paths are safe under filtering, even 
minor generalizations of the weighting function compromise 
safety (Section 4.2). 

Second, we define a dispute ring, a special case of the 
"dispute wheel" (a group of nodes whose rankings have a 
particular form) of Griffin et al. [10], and show that any 
routing system that has a dispute ring is not safe under filter- 
ing (Section 5). Using the dispute wheel concept, Griffin et 
al. showed a sufficient condition for safety, proving that if a 
routing system is unsafe then it must have a dispute wheel. 
In contrast, to our knowledge, our result is the first known 
necessary condition for safety under filtering. 

Third, we show that under ranking independence and un- 
restricted filtering, the set of allowable rankings that guaran- 
tee safety is effectively ranking based on (weighted) shortest 
paths. In Section 6, we prove that any routing system that 
permits paths of length n+2 to be ranked over paths of length 
n can have a dispute ring, and is thus unsafe under filtering. 
We also prove that any routing system that permits paths of 
length n + 1 to be ranked over paths of length n can have 
a dispute wheel. In summary, our results indicate that sta- 
ble policy routing with provider independence (i.e., ranking 
independence and unrestricted filtering) requires tight con- 
straints on rankings. 

Our findings may be interpreted in several ways. The opti- 
mist will note that checking a set of rankings to ensure safety 
is trivial, because all it requires is that BGP routers mod- 
ify the decision process to consult a route's "local prefer- 
ence" attribute only after considering its AS path length. The 
pessimist, however, will note that guaranteeing safe routing, 
preserving ranking independence, and allowing unrestricted 
filtering, requires constraints that may be too strong to per- 
mit sufficient ranking expressiveness, since it effectively pre- 
cludes an AS from ranking longer paths over shorter ones. In 
either case, our results suggest that stable interdomain rout- 
ing protocols face a fundamental tradeoff between the ex- 
pressiveness and independence of an AS's policies. 



2. Background and Related Work 

A seminal paper by Varadhan et al. observed that policy- 
based interdomain routing protocols could oscillate and de- 
fined the concept of safety [16]. Varadhan et al. also con- 
jectured that routing systems that allow rankings other than 




Figure 2: Constraints on filtering and topology are not enforceable. 

those based on next-hop rankings or shortest path routing 
maybe unsafe [16]. 

Griffin et al. asked how expressive an autonomous, robust 
routing system can be; this paper addresses this question [9]. 
Varadhan et al. showed that a routing system with an acyclic 
topology will have at least one stable path assignment if par- 
ticipants can only express next-hop preferences [16]. Feigen- 
baum et al. also observed this fact for general topologies [4]. 
In this paper, we show that when BGP's protocol dynamics 
are taken into account, restricting each AS to only next-hop 
rankings does not guarantee that the routing system will be 
safe (even though the routing system always has at least one 
stable path assignment). 

Gao and Rexford derived sufficient constraints on rank- 
ings, filtering, and network topology to guarantee routing 
stability; they also observe that these constraints reflect to- 
day's common practice [5, 6]. They showed that if every 
AS considers each of its neighbors as either a customer, a 
provider, or a peer, and obeys certain local constraints on 
rankings and filtering, and if the routing system satisfies cer- 
tain topology constraints, then BGP is stable. However, their 
model does not incorporate ranking independence, as their 
proposed topological constraints are global. Furthermore, 
their model restricts filtering; the example below illustrates 
why these restrictions may sometimes be too strict. 

Example 2 Figure 2 shows a situation that occurred in the 
Internet in 2001 [2]. When PSINet terminated its peering 
with AboveNet, AboveNet lost connectivity to PSINet's cus- 
tomers, di . To restore connectivity, AboveNet bought "tran- 
sit" service from Verio (already a peer of PSINet), but only 
for routes to PSINet and its customers. 

Verio does not filter rfi (or any of PSINet's prefixes) from 
AboveNet, which is only possible if Verio treats AboveNet 
as a customer. The constraints imposed by Gao and Rexford 
state that an AS must prefer customer routes over peering 
routes. 1 This constraint requires Verio to rank AboveNet's 
route to g?2 over any other available routes to d^ in order to 
guarantee stability, which restricts Verio's flexibility in how 
it can select routes. Establishing a new business relationship 
(and, hence, altering its filtering policies) requires Verio to 
change its rankings as well. ■ 

Various previous work has studied global conditions to 
guarantee the safety of routing systems; global conditions 
presume that the routing system does not preserve local 
choice of rankings (i.e., ranking independence). Griffin et 
al. showed that, if the rankings of the ASes in a routing sys- 
tems do not form a dispute wheel (a concept that describes 

1 Gao and Rexford present a weaker constraint that allows an AS to rank 
routes learned from customers and peers over those from providers, but does 
not require customer routes to be strictly preferred over routes from peers. 
This relaxed condition requires that there are no instances where an AS's 
customer is also a peer of another one of the AS's peers. Of course, Exam- 
ple 2 could also violate this constraint on the topology: PSINet is Verio's 
customer for di , but it would be reasonable for PSINet to peer with another 
of Verio's peers, since all are "tier-1" ISPs. 



global relationship between the rankings of a set of ASes), 
then the routing system is safe [10]. Griffin et al. also 
showed how to modify a BGP-like path vector protocol to 
detect the existence of a dispute wheel but left unspecified 
how the ASes should resolve the dispute wheel [11]. Machi- 
raju and Katz defined a new global invariant for determining 
safety when at most one AS deviates from the conditions of 
Gao and Rexford [13]. Govindan et al. proposed a routing 
architecture where ASes coordinate their policies [7, 8] us- 
ing a standardized policy specification language [1]. Jaggard 
and Ramachandran presented global conditions that guar- 
antee safety of routing systems that allow ASes to express 
only next-hop preferences over routes, and designed central- 
ized and distributed algorithms to check these global con- 
ditions [12]. Sobrinho defined new concepts that describe 
global relationships between preferences and incorporated 
several previous results (including those of both Griffin et 
al. [10] and Gao and Rexford [6]) into a single algebraic 
framework [15]. In contrast to these studies of global condi- 
tions for safety, this paper studies the conditions under which 
a policy-based interdomain routing protocol can be stable if 
it preserves ranking independence. 

3. Routing Model and Definitions 

We now define our routing model. After introducing some 
basic terminology, we formally define two notions of good 
behavior for routing protocols: stability and safety. Finally, 
we extend each of these two definitions to deal with the case 
where ASes may arbitrarily filter paths from each other. 

3.1 Preliminaries 

We consider a model consisting of N ASes (nodes) 2 , la- 
beled 1, . . . , N. Each of these nodes wishes to establish a 
path to a single destination, labeled node 0. We precisely 
define a path next. 

Definition 1 (Path) A path from i to j is a sequence of nodes 

P = ii\i2 ■ ■ ■ i m j with no repeats,; i.e., such that i u =/= i v if 

m/d, and i u ^ i, j for all u. 

We denote the number of hops in a path P as length(P); 
note that a path with n nodes has n — 1 hops. In addition, 
given an AS k, we will write k e P if node k appears in P. 
For clarity, given a path P from i to j, we will often denote 
P by iPj; furthermore, if P is a path from i to j, and Q is a 
path from j to k, then we will denote the concatenation of P 
and Q by iPjQk. 

We denote the set of all paths from % to (i.e., all paths on 
the complete graph) using the nodes 1 , . . . , N by Vf . Given 
the set of nodes {1, . . . , N}, each AS i will choose a ranking 
<i over the set of all paths Vf ' , defined as follows. 

Definition 2 (Ranking) Given N, a ranking -<i for node i is 
a total ordering over the set of all paths Vf ; thus, given any 
two paths P,Qg Vf , either P -<$ Q (i prefers Q to P) or 
P >iQ (i prefers P to Q). 

An AS may always choose the empty path, e, which is 
equivalent to total disconnection from the destination node 
0. Thus, we have e € Vf for all i and N. Furthermore, we 



2 In this paper, we use the terms "AS" and "node" interchangeably. 



assume that every AS strictly prefers connectivity to discon- 
nectivity, so that P >- $ e for all P <E Vf . 

Note that all paths may not be available to node i, due 
to both topological constraints and filtering by other nodes. 
Throughout the paper, we will use Ti C Vf to denote the 
set of paths actually available for use by node i. The empty 
path is always available; i.e., e € Ti. 

A routing system is specified by the rankings of the indi- 
vidual nodes, together with the paths available to the individ- 
ual nodes. Observe that we have decoupled the "routing pol- 
icy" of each AS % into two components: the rankings -< i of 
AS i over route advertisements received (i.e., a "ranking"); 
and a determination of which paths are filtered from other 
ASes (i.e., "filtering"). The filtering decisions of all nodes, 
together with physical constraints on the network, yield the 
sets T\, . . . , Tn- We thus have the following formal defini- 
tion of a routing system. 

Definition 3 (Routing system) A routing system is a tuple 
(TV, -<i, . . . , -<AT)^i) • • • ,3~n), where nodei has ranking -< j 
over the set Vf , and T% is the set of paths available to node 

i. 

A routing system specifies the input to any interdomain 
routing protocol we might consider. Given this input, the 
protocol should converge to a "routing tree": that is, an as- 
signment of a path to each AS, such that the routes taken to- 
gether form a spanning tree rooted at 0. To formalize this no- 
tion, we must define path assignments and consistent paths. 

Definition 4 (Path assignment) A path assignment for the 
routing system (TV, -<i, . . . , -<jv, T\, . . . , Tn) is a vector of 
paths P = (Pi, . . . , P/v) such that, for all i, Pi € T%. 

Thus, a path assignment is an assignment of a feasible path 
to each AS i, where feasibility is determined by the set of 
paths Ti. Even though each node has a path assigned, these 
paths may not be consistent: node % may be assigned a path 
Pi = ijPj0> where j is the first node traversed on Pi, and 

where Pj is a path from j to 0. However, the path P, may 
not be the same as the path Pj assigned to j in the path as- 
signment P; in fact, P, may not even be in the set of feasible 

paths Tj. For example, a node or link along the path Pj may 
experience a failure, causing the routing protocol to with- 
draw the path; if j has heard such a withdrawal but i has not, 
then it is possible that Pj = ijPjO until node i learns that 

Pj no longer exists. To formally capture such situations, we 
now define consistent paths and consistent path assignments. 

Definition 5 (Consistent path) Given a path assignment P, 
a path Pi for node i is consistent with P if one of the follow- 
ing holds: 

1. Pi = e; or 

2. Pi = i0; or 

3. Pi = ijPjO, for some j =/= i. 

It is clear that a routing protocol where packets are routed 
solely on destination should ultimately assign paths that are 
consistent with each other. We now formally define a consis- 
tent path assignment. 



Definition 6 (Consistent path assignment) A con- 

sistent path assignment for the routing system 
(N, -<i, . . . , -<jv, J-\, . . . , J-'n) is a path assignment 
vector P = (Pi , . . . , Pn) such that for all i, Pi is consistent 
with P. 

3.2 Stability and Safety 

Informally, a path assignment is stable if it is consistent, 
and no node has a more preferred consistent path available. 

Definition 7 (Stable path assignment) Given a routing 
system (TV, -<i, . . . , -<n,J~i, ■ ■ ■ ,J~n)> and a consistent 
path assignment P, we say that P is stable if for all nodes 
i, and all paths Pi that are consistent with P, Pi -<j Pj. 

Definition 8 (Stable routing system) The routing system 

(N, -<i, . . . , -<at, J-\, . . . , J-'n) is stable if there exists at 
least one stable path assignment P. 

The stability of a routing system does not indicate whether 
a routing protocol will converge regardless of the initial path 
assignment. For this purpose, we introduce safety, which 
states that a protocol eventually converges, regardless of the 
initial path assignment and ordering of the routing messages. 

In defining safety, we will consider a simplified abstrac- 
tion of BGP. We model the process by which nodes receive 
route advertisements from other nodes and subsequently up- 
date their own route decisions. In this paper, we will consider 
a protocol dynamic where at each time step only a single AS 
is activated; when activated, an AS immediately processes 
all pending incoming route advertisements, and then makes 
a route decision. Formally, this will translate into a path as- 
signment sequence where exactly one node (the "activated" 
node) changes its route at any given time step. 

A routing system is safe if no oscillation occurs regardless 
of the order in which nodes are activated. We start, therefore, 
by defining a fair activation sequence. 

Definition 9 (Fair activation sequence) The sequence 
i\,i<2,..- is a fair activation sequence if each node 
i = 1 , . . . , N appears infinitely often in the sequence. 

This definition of fair activation sequence is similar to that 
presented by Gao and Rexford [6], except that in our defini- 
tion we only activate one node at a time. This distinction is 
not major: we can interpret the Gao and Rexford dynamics 
as a model where outstanding routing messages may be in 
flight when a particular node is activated. 

We now define our simplified model of the routing proto- 
col dynamics: that is, starting from an initial path assignment 
Po, and given a fair activation sequence of nodes i i, *2 5 - - -. 
what is the resulting observed sequence of path assignments 
P\,P-2, . . .? To formalize the dynamics of our model, we 
consider an abstraction of the BGP decision process de- 
scribed in Figure 3. At each time t, a node i t is activated, 
and chooses its most preferred available path consistent with 
the path assignment Pt i- All other nodes' paths remain 
unchanged. It is clear that this decision process yields a se- 
quence of path assignments Pi, P2, .... 

After any given activation step t, the overall path assign- 
ment P t may not be consistent. Inconsistencies reflect the 
fact that a node only updates its path assignment in response 



Routing protocol dynamics 

At time t—1, the current path assignment is Pt-i', '•<?., each 
node i has currently selected path p.t-i to the destination 0. 
At time t: 

1. A given node i t is activated. 

2. Node i t updates its path to be the most preferred path 
(according to -<j t ) consistent with Pt-i- That is, 

(a) Pi t .t € Ti t is consistent with Pt-i, and 

(b) P lt . t > it P it VPj, € T lt consistent with P t -\- 

3. All other nodes leave their paths unchanged. 



Figure 3: The routing protocol dynamics, given an activation sequence 
i\ , 12 , • • ■• The process starts from an initial path assignment Pq. 

to the receipt of a route advertisement. If, at time to, a node 
i is using a path that traverses some other node j that has 
since changed paths, then node i would obliviously continue 
to use (and advertise) that inconsistent path until it receives 
a routing update that reflects that the path through j has dis- 
appeared or changed. When activated, say, at time t > to, 
node i would discover that the path it was using was inconsis- 
tent with P t and would then instead select its highest-ranked 
path that was consistent with P t . The activation of a node at 
some time t corresponds to that node receiving all available 
routing information in the system up to that time. 

With the definition of our protocol dynamics in hand, we 
can define protocol safety. Given a routing system and an 
activation sequence, we say that the system has converged if, 
after some finite time, the path assignment remains invariant 
for all future time. A protocol is safe if it converges to a sta- 
ble path assignment, regardless of the initial path assignment 
and fair activation sequence. 

Definition 10 (Safety) A routing system (N, -< 1, . . . , -<jv 
,T\, . . . , J-'n) is safe if for any initial path assignment Pq 
and fair activation sequence ii, 12, ■ ■ ■, there exists a finite ti 
such that P s = Ptfor all s,t > U. 

We observe that since the activation sequences are fair in 
the preceding definition, if a routing system converges to P t , 
then the resulting path assignment to which the system con- 
verges must be both consistent and stable. If not, at least one 
node would change its path assignment eventually. 

3.3 Filtering 

In this paper, we are interested in the stability and safety 
of systems that result when nodes are allowed to filter routes 
from other nodes. We thus require conditions stronger than 
stability and safety, known as stability under filtering and 
safety under filtering. Informally, a routing system is stable 
(respectively, safe) under filtering if, under any choices of 
export filters made by the ASes, the resulting routing sys- 
tem is always stable (respectively, safe). We formalize these 
notions as follows. 



Definition 11 (Stable under filtering) The routing system 
( N, -< 1 , . . . , -< jv , J~i ) • • • , J~n ) is stable under filtering if for 



all choices of available paths T C Tifor i = 1, . . . , N, the 
routing system (N, -< i , . . . , -<n, Ti, ■ ■ ■ , Tn) is stable. 

Definition 12 (Safe under filtering) The routing system 
(N, -<i , . . . , -<n, Ti, ■ ■ ■ , Tn) is safe under filtering if, for 
all choices of available paths Ti C Tifor i = 1, . . . , N, the 
routing system (N, -< i , . . . , -< jv, T\, ■ ■ ■ , Tn) is safe. 

We interpret these definitions as follows. The set of avail- 
able paths Ti gives the set of paths that are physically possi- 
ble for AS % to use, given the current network topology. Once 
all ASes have chosen their route filters (which may be arbi- 
trarily defined), the set Ti gives the set of paths that can ever 
be used by node i in route advertisements. Since we allow ar- 
bitrary choice of filters, the resulting routing system should 
be stable and safe regardless of the choices of T\, ■ ■ ■ , Tn 
that are made. 

4. Ranking Classes and Safety 

In this section, we study two natural ranking classes un- 
der which ASes retain policy independence in setting rank- 
ings over paths. First, in Section 4.1, we study the rank- 
ings where each AS is allowed to rank paths solely based on 
the immediate next-hop AS, called "next-hop rankings". We 
show that (1) there are routing systems where each node has 
only a next-hop ranking that are unsafe; and (2) even though 
all routing systems where nodes have next-hop rankings are 
stable, there exist some routing systems of this form that are 
not stable under filtering. 

In Section 4.2, we study the properties of routing systems 
where each node is allowed to choose a weight for all its out- 
going links, and rankings are derived from a "total" weight 
associated to each path. The total weight of a path is de- 
fined as the weight of the first link on that path, plus a dis- 
counted sum of the weights of all remaining links on that 
path. We show that if the discount factor is anything other 
than 1 (which corresponds to shortest path routing), then 
there exist weight configurations that yield an unsafe rout- 
ing system. 

4.1 Next-Hop Rankings 

One natural set of rankings for a routing system is one 
where each AS can express rankings over paths solely based 
on the next-hop AS in the path. Such a class of rankings 
makes sense because an AS establishes bilateral contracts 
with its immediate neighbors and, as such, will most often 
wish to configure its rankings based on the immediate next- 
hop AS en route to the destination. For example, an AS will 
typically prefer sending traffic via routes through its neigh- 
boring customer ASes over other ASes, since those customer 
ASes are paying based on traffic volume. We formally define 
next-hop rankings as follows: 

Definition 13 (Next-hop ranking) Given N, -< $ is a next- 
hop ranking if for all nodes j, k with i,j,k distinct, we have: 

ijPjO <i ikP k => ijPfi <i ikP' k Q, (1) 

for all P 3 ,P^ e Vf, and Pk,P' k ^ "Pf • {Here we interpret 

K = {s}.) 

Thus, -<j ranks paths based only on the first hop of each 
path. 



3,0,2 (T) -(3) 2,0,1 





Activate 


1 


2 


3 


— 


(10) 


(2 0) 


(3 2 0) 


2 


(10) 


(210) 


(3 2 0) 


1 


(13 2 0) 


(2 10) 


(3 2 0) 


3 


(13 2 0) 


(2 10) 


(3 210) 


2 


(13 2 0) 


(2 0) 


(3 2 10) 


1 


(10) 


(2 0) 


(3 2 10) 


3 


(10) 


(2 0) 


(3 2 0) 



(a) Routing system 



(b) Activation sequence 



Figure 4: Next-hop rankings are not safe in this routing system. AS 1 
prefers all paths through AS 3 over the direct path to the destination 
(with ties broken deterministically) and prefers the direct path over all 
paths through AS 2. Similarly, AS 3 prefers all paths via AS 2, and so 
forth. 

Such a restriction on policy would still be sufficiently rich 
to achieve most traffic engineering goals, since most policies 
are based on the immediate next-hop AS [3], Additionally, 
this set of rankings might appear to be expressive enough for 
most policy goals, since most routing policies are dictated 
according to the AS's business relationship with its immedi- 
ate neighbor. 

Previous work has shown that a routing system where 
each node has a next-hop ranking always has at least one 
stable path assignment [4]. In this section, we first show 
that there exists a routing system where each node has a 
next-hop ranking and the system is unsafe, even with no 
filtering. Then, we show that there may exist T\ . . . Tn, 
where Ti C Ti for all i, such that even though the sys- 
tem (N, -<i . . . -<n, T\ . . . Tn) is stable, the filtered system 
(N, -<i ... -<jv, T\ . . . Tn) is unstable. That is, there exist 
routing systems with next-hop rankings for which a stable 
path assignment exists, but introducing filtering can yield a 
system where no stable path assignment exists. 

Observation 1 A routing system where each node has only 
a next-hop ranking may be unsafe. 

Example 3 A routing system where each node has a next- 
hop ranking may not be safe. Consider Figure 4. In this 
example, each AS ranks every one of its neighboring ASes. 
For example, AS 1 prefers all paths that traverse AS 3 as the 
immediate next hop over all paths that traverse AS as the 
immediate next hop, regardless of the number of ASes each 
path traverses; similarly, AS 1 prefers paths that traverse AS 
as the immediate next hop over paths that traverse AS 2. 
Each AS readvertises its best path to the destination to all of 
its neighbors (i.e., the system has no filtering). Now consider 
the activation sequence in Figure 4(b); if infinitely repeated, 
this activation sequence would be fair, and the routing system 
would oscillate forever. Thus, the routing system is not safe. 
Note that this system is not safe, but it is stable: for ex- 
ample, the path assignment (10, 210, 3210) is stable. Nodes 
2 and 3 are using paths through their most preferred nodes. 
Node l's most preferred node, node 3, is using a path that 
already goes through node 1, so node 1 is also using its most 
preferred consistent path. As every node is using its most 
preferred consistent path, no node will change paths when 
activated, so the path assignment is stable. ■ 

A routing system where each node has a next-hop ranking 
may not be safe, but Feigenbaum et al. showed that there is 
always guaranteed to be at least one stable path assignment 
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Figure 5: This routing system is stable without filtering but unstable 
under filtering. The figure shows an unsafe routing system with next- 
hop rankings and filtering that is equivalent to the unstable routing 
system with the rankings over paths shown in Figure 1. 




Figure 6: Routing system with edge weight-based rankings. 

for such routing systems [4]. However, allowing nodes to 
filter paths from each other can create routing systems for 
which there is no stable path assignment. 

Observation 2 There exist routing systems with next-hop 
rankings for which a stable path assignment exists, but in- 
troducing filtering can yield a system where no stable path 
assignment exists. 

Example 4 Consider Figure 5. As before, each AS ranks 
every one of its neighboring ASes. Additionally, each AS 
may also declare arbitrary filtering policies. In this example, 
each AS (other than the destination) does not readvertise any 
indirect path to the destination. For example, AS 1 does not 
advertise the path 130 to AS 2, and thus the path 2130 is 
not available to AS 2. Formally, we define T\ = {130, 10}, 
T 2 = {210, 20}, and T 3 = {320, 30}. 

It is possible to show that the resulting routing system is 
actually equivalent to the system in Figure 1, once the fil- 
tered paths are removed from each node's ranking. Thus, 
the filtered routing system is unstable by the same reason- 
ing as in Example 1 : for any path assignment in this routing 
system, at least one AS will have a higher ranked consis- 
tent path (and, hence, has an incentive to deviate from the 
path assignment). For example, consider the path assign- 
ment Pi = (130, 20, 30). AS 3 prefers to switch paths to 
320, since 2 is its preferred next hop AS. ■ 

Using a construction similar to that in Example 2, it is 
possible to show how this example could arise in practice. 
The example demonstrates the complex interaction between 
filtering and rankings — a class of rankings that guarantees 
stability without filtering can yield unstable routing systems 
under certain filtering conditions. 

4.2 Edge Weight-Based Rankings 

There exists at least one routing model that preserves rank- 
ing independence and yet ensures stability: if each provider 
is allowed to choose edge weights for its outgoing links, and 
each provider ranks paths based on the sum of edge weights, 
the resulting "shortest paths" routing system is guaranteed 



to be safe [10]. Since this result holds for any T\, ■ ■ . , Fn, 
any routing system built in this way is guaranteed to be safe 
under filtering. In this section, we will formulate a general- 
ized model of such edge weight-based rankings, with both 
next-hop rankings and shortest path routing as special cases. 
Such rankings do not allow providers to directly specify their 
ranking; rather, the rankings of each provider are derived 
from the strategic choices made by all providers, namely, 
the choices of outgoing link weights that each provider sets. 
This notion of "derived" rankings is a potentially useful 
method for ensuring policy independence in interdomain 
routing protocols. 

Definition 14 (Edge weight-based rankings) 

(N, -<i, ...,< n, F\, ■■■ t^Fn) is a routing system with 
edge weight-based rankings if there exists an assignment 
of edge weights Wij to each ordered pair of ASes i,j, 
together with a parameter a G [0, 1], such that for each 
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The interpretation of this definition is as follows. Each 
node chooses edge weights for all possible outgoing links; 
i.e., node i chooses a weight Wij for each node j. Next, 
node i determines its rankings by ordering all paths Pi = 
iii...i n in increasing order according to their weight 

Wih + a {YJk=i w i k i k+ i + w i n o), where a is a global pa- 
rameter used to weight the tail of the path. The parameter 
a allows us to compare two extreme points: a = 1, corre- 
sponds to shortest path routing based on the matrix of edge 
weights w, while a = corresponds to next-hop rankings. 
A natural question to ask is whether a routing system us- 
ing edge weight-based rankings can be safe for intermediate 
values of a. It turns out that the only edge weight-based 
ranking class that can guarantee safety (and safety under fil- 
tering), regardless of the weights chosen by each provider, is 
the scheme defined by a = 1; i.e., shortest path routing. 

Observation 3 A routing system with edge weight-based 
rankings may be unstable for any a where < a < 1. 

Example 5 Consider the routing system shown in Figure 6. 
If the system is such that each node prefers the two-hop 
path to the destination, followed by the one-hop (i.e., di- 
rect) path, followed by the three-hop path, then the system 
will be unstable because its behavior will match Example 1. 
The routing system will be unstable if the following condi- 
tions are satisfied, for all i — 1,2,3: w,,j+i + aWi+i t o < 
w t fi < Wis+i + a(wj+i i i+2 + Wi+2,0) (for addition modulo 
3). If a = 1, these inequalities cannot be simultaneously 
satisfied for any nonnegative choice of the edge weight vec- 
tor w; this is to be expected, since a = 1 corresponds to 
shortest path routing. On the other hand, if < a < 1, 
then many vectors w exist satisfying the inequalities above. 
For example, we can choose wio = W20 = W30 = 1, 
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Figure 7: Relationships between safety and dispute rings and wheels. 
Previous work showed that a routing system with no dispute wheel is 
safe [10]. Section 5 presents all other relationships shown in this figure. 

and let w\2 — W23 = W31 = x, for any x such that 
(1 — a)/(l + a) < x < 1 — a. For this definition of w, all 
three inequalities above will be satisfied, and thus the rank- 
ings of each node will lead to the same oscillation described 
in Example 1 . ■ 

5. Dispute Wheels and Dispute Rings 

Our goal is to study the classes of rankings for which 
the routing system is guaranteed to be safe under filtering. 
Safety is a dynamic concept, and Griffin et al. have shown 
that checking whether a particular routing system is safe is 
NP-hard [10]. To simplify our study of safety, we introduce 
a useful concept developed by Griffin et al. [10], known as a 
dispute wheel. Informally, a dispute wheel gives a listing of 
nodes, and two path choices per node, such that one path is 
always preferred to the other. If a routing system oscillates, 
then it is possible to construct a dispute wheel whereby each 
node in the wheel selects its more preferred path (via the 
node in the clockwise direction) over its less preferred path. 
Griffin et al. showed that if a routing system with no filtering 
does not have a dispute wheel, then it is safe. 

The dispute wheel is a useful concept because it allows 
us to analyze dynamic properties such as safety by simply 
looking at the rankings of each node in the routing system. 
In this section, we formally define a dispute wheel and show 
the relationship of Griffin's routing model, which simulates 
messages being passed between nodes, to the model we use 
in this paper, which uses fair activation sequences. This re- 
lationship allows us to leverage Griffin's previous results to 
study safety in terms of the routing model in this paper. We 
then extend the framework of Griffin et al. by defining a 
special type of dispute wheel called a dispute ring and show 
that, if any routing system has a dispute ring, then it is unsafe 
under filtering. Finally, we relate dispute wheels to dispute 
rings and show that, although the presence of a dispute ring 
guarantees that a routing system is unsafe under filtering, it 
does not necessarily imply that a routing system is unsafe 
without filtering. Figure 7 summarizes the results of this sec- 
tion and how they relate to results from previous work [10]. 

5.1 Dispute Wheels and Safety 

We start by formally defining dispute wheels. 

Definition 15 (Dispute wheel) Given a routing system 
(N, -<i, . . . , -<n, T\, . . . , Tn), a dispute wheel is a collec- 
tion of distinct nodes i\ , . . . , i m , called pivots, together with 
two sets of paths Pi, ... , P m and Q 1 , . . . , Q m , such that the 
following conditions hold (where we define i m +i — i\ for 
notational convenience): 




1. Pk e T lk forallk = 1, 



, m; 



Figure 8: Illustration of a dispute wheel. Dotted lines show preferred 
(indirect) paths to the destination. The nodes h,...,i m are pivots. 

2. Qk is a path from ik to ik+ifor all k = 1, . . . ,m; 

3. The path Pk = ikQkik+iPk+iO is feasible, i.e., Pk € 
J 7 i k , and 

4. P k y ik P k . 

Thus, each node ik prefers the path ikQkik+iPk+i® to the 
path ifePfcO. Figure 8 shows a graphical representation of a 
dispute wheel. 

As previously shown by Griffin et al. [10], the most im- 
portant feature of dispute wheels for our purposes is that if 
a routing system has no dispute wheels, then it is safe. To 
use this result for analyzing routing systems as we defined 
in Definition 3 (Section 3), we must show that safety in the 
Simple Path Vector Protocol (SPVP) defined by Griffin et 
al. [10] implies safety in our model. 

Proposition 1 Given a routing system, a fair activation se- 
quence, and an initial path assignment P $, let P\, P2, ■ ■ ■ 
be the resulting sequence of path assignments according to 
the dynamics described in Figure 3. Then there exists a 
sequence of messages in the Simple Path Vector Protocol 
(SPVP) such that the same sequence of path assignments is 
observed. 

Thus, in particular, if a routing system is safe under SPVP, 
then it is safe according to Definition 10. 

Proof Sketch. The key difference between SPVP and the dy- 
namics we have defined is that SPVP is asynchronous (i.e., at 
any time step, messages may be in flight), so different nodes 
may have different assumptions about the global path assign- 
ment at any time. However, SPVP is nondeterministic with 
respect to the timing of messages; the delay between a rout- 
ing update at node j and the receipt of the new route adver- 
tisement from node j at node i can be arbitrary. We use this 
fact to construct, inductively, a sequence of messages such 
that at time t, the current set of paths available to node i t in 
SPVP corresponds exactly to Pt-i- Furthermore, we time 
the delivery of routing updates to node i t in SPVP so that 
any updates that occurred since the last time i t was activated 
arrive exactly at the start of time step t. In SPVP, this will ini- 
tiate a routing update at node i t , which corresponds exactly 
to the activation of i t in our model (see Figure 3). 

Thus, the sequence of path assignments seen in this real- 
ization of SPVP matches the sequence of path assignments 
seen in our dynamics. We conclude that if SPVP is guaran- 
teed to be safe for the given routing system (i.e., if eventu- 
ally no further routing updates occur, regardless of the initial 




Figure 9: A routing system that is safe for any choice of filters. 

path assignment), then the routing system is safe according 
to Definition 10 as well. ■ 



Corollary 1 If a routing system (TV, -<i, . . . , -<n, 
Ti, ■ ■ ■ , Tn) has no dispute wheel, then it is safe. 

Corollary 2 If a routing system (N, -<i, . . . , -<n, 
Ti, ■ ■ ■ -i3~n) has no dispute wheel, then it is safe un- 
der filtering. 

Proof. Choose subsets Ti C Ti. Then, any dispute wheel 
for the routing system S — (TV, -<i, . . . , -<n, T\, . . . , Tn) 
is also a dispute wheel for the original routing system S — 

(n,^ 1 ,...,-< n ,t 1 ,...,t n ). m 

We conclude that if no dispute wheel exists, then not only 
does this guarantee any resulting routing system is safe, but 
it will also ensure safety under filtering. Unfortunately, this 
condition is not a necessary condition for safety, and thus 
not much can be said about a system that does have a dispute 
wheel. Furthermore, there exist routing systems that have a 
dispute wheel but which are safe under filtering. 

Observation 4 The existence of a dispute wheel does not im- 
ply that the routing system is unsafe, nor that the routing sys- 
tem is not safe under filtering. 

Example 6 See Figure 9. The first two most preferred paths 
in each node's ranking form a dispute wheel, but the sys- 
tem is safe: the system converges to P = (10, 20, 30). Fur- 
thermore, no combination of filters can create an oscillation. 
The two-hop paths are not part of the stable path assign- 
ment, so filtering those paths has no effect on the protocol 
dynamics. Filtering a three-hop path would simply result in 
a node selecting the direct path to the destination, and the 
node would never deviate from that path; thus, an oscilla- 
tion would not occur. If one direct path is filtered, then the 
other two nodes will take direct paths to the destination and 
the node whose direct path is filtered will take its most pre- 
ferred three-hop path. If two direct paths are filtered, then 
P is simply a chain to the destination: the node that has the 
direct path takes it, and the other two nodes will take two and 
three-hop paths. ■ 

5.2 Dispute Rings and Safety 

In this section, we extend the dispute wheel notion to 
understand the relationship between ranking expressiveness 
and safety under filtering. We define a relationship between 
rankings called a dispute ring, a special case of a dispute 
wheel where each node appears at most once. 



Definition 16 (Dispute ring) A dispute ring is a dis- 
pute wheel — a collection of nodes i i , . . . , i m and paths 
Pi, ... , P m , Q\ , . . . , Q m satisfying Definition 15 — such that 
m > 3, and no node in the routing system appears more than 
once in the wheel. 

The dispute ring is a useful concept because it allows us to 
prove a necessary condition for safety under filtering. 

Proposition 2 If a routing system has a dispute ring, then it 
is not safe under filtering. 

Proof. Assume that a routing system has a dispute ring, 
defined by i lt . . . , i m , and paths Qi, . . . , Q m , Pi, ... , P m . 
Then, construct filters such that Ti contains only the paths 
in that dispute ring. Specifically, Ti contains the following 
paths from Vf (where we define i m +i = ii). ( 1 ) If i is not 
in the dispute ring, then Ti = 0. (2) If i is a pivot node on the 
dispute ring, say i = if., then Ti contains exactly two paths: 
Pfe, and ikQkik+iPk+i®- (3) If % is not a pivot node, but 
i £ Qk for some k, then we can write Q k = ikQ^iQ^ik+i- 
In this case Ti consists of the single path iQ\i k+ iP k+ iQ. (4) 
If i is not a pivot node, but i £ P k for some k, then we can 
write P k = i k P k iP k ^i. ^ n this case, Ti consists of the sin- 
gle path iP k 0. Since each node appears at most once on the 
dispute ring, the preceding definition uniquely defines Ti for 
all nodes i. 

There exists at least one consistent path assignment P t 
such that some pivot node ik-i is using its most preferred 
path, ik-iQk-iikPk®, every other pivot node ij is using 
path ijPjO, and every other non-pivot node i uses its only 
available path consistent with this assignment. Then, the fol- 
lowing activation sequence will result in an oscillation: 

1. Activate node i k . Node i k then switches to its more 
preferred path, i k Q k i k+1 P k+1 0. 

2. Activate nodes along Qk-1 in reverse order, from the 
node immediately preceding i k , to i k -\. All nodes 
along Qfc_i switch to the empty path, e. 

3. Activate node i k -\. The path i k -\Q k -\i k P k {) is 
now inconsistent, so i k -\ must switch to the path 
ifc-iPfe-iO. 

4. Return to Step 1 with k replaced by k + 1, and iterate 
again. 

By the fourth step of the iteration above, the new path as- 
signment is "isomorphic" to the initial configuration: now 
node i k is using the path i k Q k i k+ iP k+ iO, and every other 
pivot node ij is using path ijPjO. Thus, as this iteration re- 
peats, the dynamics will ultimately reach node i k once again 
with the original path assignment. Note that all paths in this 
activation sequence are guaranteed to be available and con- 
sistent, by the definition of Ti. To make this activation se- 
quence fair, we must also activate (1) the nodes that are not 
in Pi U Qi for any i in the dispute ring; and (2) the non-pivot 
nodes in Pi for all i in the dispute ring. The nodes that are 
not in Pi U Qi for any % have only the path e available, and 
each non-pivot node in Pj (for all i) has only one path to 
the destination available. Therefore, these nodes will never 
change paths, and do not affect the oscillation. ■ 

We emphasize that, for simplicity, we reduced the set of 
filters, Ti, to include only the set of paths that are involved 
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Figure 10: System that (1) has no dispute ring and (2) is not safe. 









Path Assignment 






Act. 


1 


2 


3 


4 


5 


6 


— 


(12 4 0) 


(2 4 0) 


(3 5 0) 


(4 0) 


(5 0) 


(6 0) 


5 


(12 4 0) 


(2 4 0) 


(3 5 0) 


(4 0) 


(51240) 


(6 0) 


1 


(16 0) 


(2 4 0) 


(3 5 0) 


(4 0) 


(51240) 


(6 0) 


3 


(16 0) 


(2 4 0) 


(3 16 0) 


(4 0) 


(51240) 


(6 0) 


4 


(16 0) 


(2 4 0) 


(3 16 0) 


(43160) 


(51240) 


(6 0) 


5 


(16 0) 


(2 4 0) 


(3 16 0) 


(43160) 


(5 0) 


(6 0) 


3 


(16 0) 


(2 4 0) 


(3 5 0) 


(43160) 


(5 0) 


(6 0) 


2 


(16 0) 


(2 3 5 0) 


(3 5 0) 


(43160) 


(5 0) 


(6 0) 


6 


(16 0) 


(2 3 5 0) 


(3 5 0) 


(43160) 


(5 0) 


(62350) 


4 


(16 0) 


(2 3 5 0) 


(3 5 0) 


(4 0) 


(5 0) 


(62350) 


2 


(16 0) 


(2 4 0) 


(3 5 0) 


(4 0) 


(5 0) 


(62350) 


1 


(12 4 0) 


(2 4 0) 


(3 5 0) 


(4 0) 


(5 0) 


(62350) 


5 


(12 4 0) 


(2 4 0) 


(3 5 0) 


(4 0) 


(51240) 


(62350) 


6 


(12 4 0) 


(2 4 0) 


(3 5 0) 


(4 0) 


(51240) 


(6 0) 



Figure 11: Activation sequence for unsafe system from Figure 10. 

in an oscillation. We note that there will typically be more 
permissive sets Ti that will also result in oscillation, since 
the dispute ring is present in the underlying set of rankings. 
Our intent is to highlight the most basic case of filtering that 
can cause an oscillation, given the existence of a dispute ring. 
Despite the fact that systems that are safe under filtering 
are guaranteed not to have a dispute ring, testing for a dispute 
ring is not sufficient to guarantee that the routing system is 
safe, as there exist routing systems without dispute rings that 
are unsafe. We give an example below. 

Observation 5 There exist unsafe routing systems that have 
a dispute wheel but do not have a dispute ring. 

Example 7 Consider the routing system described by 
Figure 10(a) and the corresponding dispute wheel in 
Figure 10(b). Suppose that nodes 1, 2, and 3 pre- 
fer two-hop paths over three-hop paths, and the only 
paths available to nodes are those depicted in the figure. 
This system is not safe; for example, suppose Pq = 
(1240, 240, 350, 40, 50, 60). The system then oscillates as 
shown in Figure 11. However, the system has no dispute 
ring; in particular, the dispute wheel depicted in Figure 10(b) 
cannot be reduced to a dispute ring. ■ 

6. Ranking Independence, 

Unrestricted Filtering, and Safety 

In this section, we determine necessary and sufficient con- 
straints on the allowable classes of rankings, such that if each 



AS acts independently in setting its ranking while filtering is 
unrestricted, the protocol is guaranteed to be safe. We use 
the static concepts of dispute rings and dispute wheels to 
simplify checking safety, a dynamic property. As a result, 
we restrict our attention to characterizing whether a routing 
system where rankings are chosen independently by each AS 
can induce either a dispute ring or a dispute wheel. 

A protocol's configurable parameters implicitly restrict the 
rankings ASes can express. (In BGP, the set of protocol 
parameters is rich enough to allow providers to express es- 
sentially any possible ranking over paths.) We must ensure 
these constraints respect the ability of each AS to set rank- 
ings independently. In Section 6.1, we axiomatically formu- 
late two properties that should be satisfied by any protocol 
that respects ranking independence: permutation invariance 
and scale invariance. The first requires the rankings allowed 
by the protocol to be independent of node labeling; and the 
second requires the allowed rankings to scale gracefully as 
nodes are added to the system. We abstract protocols sat- 
isfying these two conditions through the notion of a local 
verifier, such a verifier takes a single ranking as input, and 
accepts it if that ranking is allowed by the protocol. 

In Section 6.2, we give two examples of such verifiers: 
the shortest hop count verifier (which only accepts rankings 
where shorter paths are preferred to longer paths), and the 
next hop verifier (which only accepts next hop rankings). We 
then determine the class of local verifiers such that, as long 
as each provider independently chooses an acceptable rank- 
ing, the resulting global routing system is guaranteed to be 
safe under filtering. 3 In Section 6.3, we show that the only 
verifiers that are safe under filtering are nearly equivalent to 
the shortest hop count verifier. 

6.1 Local Verifiers 

In this section, we define a local verifier, which serves as 
an abstraction of the protocol's constraints on allowed rank- 
ings over routes. We start by defining a (local) verifier, which 
takes as input the ranking of a single AS i, -< f and deter- 
mines whether that set of rankings is allowable. 

Definition 17 (Local verifier) Given N nodes, a verifier 
Tt{<i) takes as input the ranking of a single AS i over all 
paths in Vf , and returns "accept" if <i is allowed by ir, 
and returns "reject" otherwise. IfTr(^i) = "accept", we 
will say that <i is tt -accepted. If we are given a routing 
system (TV, -<i, . . . , -<!jv, T\, ■ ■ ■ , Tn) where each -<i is ir- 
accepted, we will say the routing system is ir-accepted. 

A local verifier applies some set of conditions or tests to 
the rankings; these conditions determine whether it should 
accept or reject the ranking -<i for any AS i. We call such 
verifiers "local" because it takes as input a ranking for a sin- 
gle AS only. 

We now define two natural conditions any verifier that pre- 
serves ranking independence should satisfy. First, the veri- 
fier's conditions on rankings should provide consistent an- 
swers to different ASes, regardless of the labeling of the 
ASes. That is, for the verifier to preserve ranking indepen- 
dence, each AS should be subject to the same constraints on 
routing policies, and those constraints should not depend on 

3 We focus on safety since it is a more practically useful concept than stabil- 
ity. 



the particular assignment of AS numbers to ASes. For exam- 
ple, suppose the routing system consists of three ASes, and 
AS 1 has an accepted ranking where it prefers 1230 over 120, 
and 120 over 10. Then we expect the same ranking should 
be accepted, even if the labels of nodes are permuted. For 
example, suppose we permute the node labels that 1 — ► 2, 
2^3, and 3 — ► 1. Then node 2 should also have an ac- 
cepted ranking where it prefers 2310 over 230, and 230 over 
20 (since 2310, 230, and 20 are the new paths that result 
after applying the permutation to 1230, 120, and 10, respec- 
tively). If this property were not satisfied, then the verifier's 
decision to accept or reject a set of rankings would depend 
on the global assignment of AS numbers to nodes, not on 
the characteristics of the individual rankings themselves. We 
call this notion permutation invariance; to define it precisely, 
we must proceed through a sequence of definitions, starting 
with path permutation. 

Definition 18 (Path permutation) Given TV nodes, let a be 
a permutation of the nodes 1, . . . , TV. Then a induces a path 
permutation on any path P — ii \i 2 . . . i m j from i to j, yield- 
ing a new path a(P) = a(i)a(ii)a(i 2 ) ■ ■ . a(i m )a(j) from 
a(i) to <j(j). We always define u(0) = 0. 

Definition 19 (Ranking permutation) Given TV nodes, let 
a be a permutation of the nodes 1, . . . , TV. Then a induces 
a ranking permutation on a ranking -< j for node i over the 
paths in Vf, yielding a new ranking c(-<i) over the paths 
in Vf {i) , as follows: IfPi,P 2 € Vf, and P x <i P 2 , then 

a(Pi)o-(<i)a(P 2 ) (where cr(Pi) is the path permutation of 
path Pi under a). 

Note that a permutation does not modify the routing sys- 
tem any substantive way, except to relabel the nodes, and to 
relabel the paths and rankings and in a way that is consistent 
with the relabeling of nodes. 

Definition 20 (Permutation invariance) A verifier -k is per- 
mutation invariant if, given TV and a ranking -< j for an AS 
i over all paths in Vf, the relation -<j is ir-accepted if 
and only if 0~(-<i) is ir-accepted, for any permutation a of 

1,...,N. 

Second, a verifier should specify conditions for acceptance 
or rejection of rankings that "scale" appropriately with the 
number of nodes in the system; we call this property scale 
invariance. Suppose, for example, that a verifier accepts a 
ranking -< j over Vf ' , when TV nodes are in the system. Now 
suppose that we add nodes to the system, so the total num- 
ber of nodes is TV > TV. As additional nodes are added to 
the system, additional paths become available as well, and 
each node i must specify its rankings over the larger set 

Vf. Informally, scale invariance of the verifier requires that 
i should be able to "extend" the ranking -< , to an accepted 

ranking over Vf ' , without having to modify its existing rank- 
ing over Vf; otherwise, the properties of allowed rankings 
would depend on the number of nodes in the global system. 
To formalize this concept, we first define a subranking. 

Definition 21 (Subranking) Given TV nodes, let -<!, be a 
ranking for AS i over all paths in Vf 1 ' . Given TV > TV, let 



<i be a ranking for AS i over all paths in Vf. Note that 
Vf C Vf. We say that -<i is a subranking of <i ifP\ <i P 2 
implies Pi<iP 2 , for all Pi,P 2 € Vf. 

We now define scale invariance. 

Definition 22 (Scaie invariance) A verifier it is scale invari- 
ant if the following condition holds: given any ir-accepted 
ranking <ifor AS i over Vf, and given any TV > TV, there 

exists at least one ir-accepted ranking Aj over Vf that has 
-<i as a subranking. 

Permutation invariance guarantees that relabeling nodes 
does not affect allowed rankings; scale invariance ensures 
that even as the set of nodes in the network increases, the 
rankings over previously existing paths should remain valid. 
Verifiers that satisfy both permutation invariance and scale 
invariance correspond to protocols that ensure ranking inde- 
pendence; we call such verifiers local verifiers. 

Definition 23 (Locai verifier) A verifier is a local verifier if 
it is both permutation invariant and scale invariant. 

We want to find protocols that are guaranteed to be safe 
under filtering. Given that we use a local verifier as an ab- 
straction of the constraints placed by a protocol on rankings, 
we would thus like to characterize local verifiers that can 
ensure safety under filtering of the entire routing system (a 
global property). For this reason, we extend the definition of 
"safety under filtering" to cover local verifiers. 

Definition 24 Let tr be a local verifier. We say that it is safe 
under filtering if all n -accepted routing systems are safe un- 
der filtering. 

6.2 Examples of Local Verifiers 

We now present two straightforward examples of local ver- 
ifiers: the shortest hop count verifier, which is guaranteed to 
be safe, but is not expressive; and the next hop verifier, which 
is expressive, but not safe. 

Example 8 Our first example is the shortest hop count rank- 
ing verifier, denoted ir shc . Given the number of nodes TV, the 
verifier ir shc accepts a ranking -<!, for node i if and only if 
the relation -< j strictly prefers shorter paths (in terms of hop 
count) over longer ones. Formally, it accepts -< j, if, for any 

two paths Pi, P e Vf such that length(Pj) < length (Pj), 
Pj >-» P- (Ties may be broken arbitrarily.) 

It is not hard to verify that 7r is a local verifier. To check 
permutation invariance, note that if -< j is allowed for node 
i, then of course for any permutation a, the ranking a(-< j) 
will also be allowed for node o~(i), as cr(<i) will also pre- 
fer shorter paths to longer paths. Scale invariance is natu- 
ral: given any shortest hop count ranking -< i over Vf, and 
given TV > TV, there obviously exists at least one shortest 
hop count ranking over Vf that has -!, as a subranking. 
Thus ir shc is scale invariant as well. However, other than 
tie breaking, 7r sftc does not allow very much freedom to the 
providers in specifying routing policies. ■ 
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7r forces all providers to use shortest AS path length, 
effectively precluding each AS from having any policy ex- 
pressiveness in choosing rankings. A more flexible set of 
rankings is allowed by the next hop ranking verifier of the 
next example. 

Example 9 The next hop ranking verifier, denoted ir , ac- 
cepts a ranking -< , for node i if and only if -< i satisfies Equa- 
tion (1) in Section 4.1; that is, if -< $ is a next hop ranking. 

It is easy to see that it nh is permutation invariant: if < , 
is a next hop ranking for node i, then clearly cr(-<i) is a 
next hop ranking for node <r(i). Furthermore, note that any 
next hop ranking -< j is determined entirely by the rankings 
of node i over each possible next hop, together with tiebreak- 
ing choices among routes with the same next hop. Thus, for 

N > N, ^.i can be extended to a next hop ranking over Vf , 
by extending node i's rankings over each possible next hop, 
and determining tiebreaking rules for any routes with next 
hop N + 1, . . . , N. We conclude that TT nh is scale invariant 
as well, and thus it is a local verifier. 

The next hop verifier ir nh grants providers greater flexi- 
bility in choosing their routing policies than under the short- 
est hop count verifier n shc . However, consider the conse- 
quences of using the local verifier ii nh . In this case, each AS 
i will choose a next hop ranking -< j, without any global con- 
straints placed on the composite vector of next hop rankings 
(-<i, ...,-< at) chosen by the ASes. We have shown earlier in 
Section 4. 1 that there exist configurations of next hop rank- 
ings that may not be stable or safe under filtering; thus, the 
local verifier 7r n?l can lead to globally undesirable behavior. 



Next, we use dispute rings and dispute wheels to charac- 
terize the class of local verifiers that are safe under filtering. 
We will prove that this class is closely related to the shortest 
hop count verifier ir shc . 

6.3 Impossibility Results 

We prove two main results in this section. Informally, the 
first result can be stated as follows: suppose we are given a 
local verifier and an accepted ranking such that some n hop 
path is less preferred (i.e., ranked lower) than another path 
of length at least n + 2 hops. (Note that this is a reversal 
of shortest hop count rankings.) Then, we can construct an 
accepted routing system with a dispute ring; i.e., one that is 
unsafe under filtering. The second result states that if some 
n hop path is less preferred than another path of length at 
least n + 1 hops, then there exists a routing system with a 
dispute wheel (though not necessarily a dispute ring). Note 
that this result is weaker than our first result, since a dispute 
wheel does not necessarily imply that the system is unsafe 
under filtering. 

We interpret these results as follows: if we are searching 
for local verifiers that are safe under filtering, we are very 
nearly restricted to considering only the shortest hop count 
verifier, since all paths of n hops must be more preferred than 
paths of at least n+2 hops to guarantee safety under filtering; 
and all paths of n hops must be more preferred than paths of 
at least n + 1 hops to prevent dispute wheels. 

Our first lemma, which is crucial to proving both of our 
results, uses permutation invariance to construct a dispute 
wheel from a single node's rankings. We use a permuta- 



i 2 = o-(i)#. P 2 = a(Pi) \ i k = u h -\i) 



■ Qi : . 



& 



Q k = v k - 1 (Qi) 



%\= % 



Pi=Pi 



P k +i=a k {Pi)'~ % ik+i=a k {i) 



Figure 12: Dispute wheel construction for Lemma 1. 

tion to "replicate" pieces of the dispute wheel until the entire 
wheel is completed. 

To state the lemma, we will require the definition of pe- 
riod of a node with respect to a permutation, as well as the 
period of a permutation. Given a permutation a on the nodes 
1 , . . . , N, let a k denote the permutation that results when a 
is applied k times; e.g., cr 2 (j) — a(a(j)), where <t° is de- 
fined to be a. 

Definition 25 (Period) Given a permutation a on the nodes 
1, . . . , N, we define the period of i under a as periodic) = 
mm{k > 1 : <J k (i) = i}. 

Thus, the period of i is the minimum number of applica- 
tions of a required to return to i. 

Definition 26 (Permutation period) Given a permutation 
a on the nodes 1 , . . . , N, we define the period of the permu- 
tation a as period(er) = min{fc > 1 : a k (i) = ifor all i}. 

Thus, pcriod(cr) is the minimum number of applications 
of a required to recover the original node labeling, and can 
be computed as the least common multiple of period ^(cr), for 
l<i<N. 

The following result establishes the conditions under 
which we can apply a permutation to a 7r-accepted ranking to 
obtain a dispute wheel. We will use this lemma as a building 
block for both of the theorems in this section. 

Lemma 1 Let tt be a local verifier. Suppose there exists a 
node i with a ranking -< j over Vf , two paths Ri,Pi £ Vf 1 ', 
and a permutation a on 1 , . . . , N such that: 

1. <i is ir-accepted; 

2. R t > t Pa 

3. periodic) = period(cr); and 

4. There exists a path Qifrom i to a{i) such that: 

Ri - tQ l <j(t)a(P t )0. (2) 

Then there exists a tr-accepted routing system for which there 
exists a dispute wheel. 

This dispute wheel is defined by pivot nodes i i , . . . , i m , 
and paths Pi, ... , P m and Q±, . . . , Q m , where m = 
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period(cr), and where for k = l,...,m, we have ih = 
tr*- 1 ^). p k = ^ fe_1 (A). andQ k = er*" 1 ^). 

Proof of Lemma. Refer to Figure 12. The key idea of the 
proof is that, since periodic) = period(cr), we can repeat- 
edly apply a to the paths Qi and p and apply permutation 
invariance to construct a 7r-accepted routing system with a 
dispute wheel. 

Let to — period(cr). Define the sequence i\,%i, ■ ■ ■ ,%m 
by if. = (7 k ^ 1 (i) for k = l,...,m. Since pcriod(cr) = 
periodic), the nodes i\, . . . ,i m are all distinct. For fc = 
1, . . . , to, define ^i fc = cr fe_1 (-<i); since the nodes i i , . . . ,i m 
are all distinct, this assignment of rankings to nodes is well 
defined (i.e., no node is assigned two different rankings). By 
permutation invariance, since -< j is 7r-accepted, we conclude 
-<,i k is 7r-accepted for all k. For all other nodes j, choose any 
7r-accepted ranking -<j. Let Tj — Vf for all nodes j. 

This permutation defines a 7r-accepted routing system 
(TV, -<i, . . . , -<at, T\, . . . , Tm)- We now construct a dis- 
pute wheel for this system. Define Qk = & (Qi), and 
Pfe = er fe_1 (p), for k — 1, . . . , m. We claim that these 
definitions yield a dispute wheel. 

Since Tj = Vf for all j, all paths are feasible. Next, since 

Qi is a path from ii = i to 12 = <x(i), we conclude that Q^ is 
a path from iy. to ife + i for all fc (where we define i m +i = ii). 
We now observe that: 



fc-i 



(J2i) - ( T fc - i (*) ( r fc - i (g j ) ( T fc ( J )a' c (P i )0 

= ikQkik+lPk+lO- 

Finally, since -<i k = <7 (-<i) and Ri >-, p, we have 



,fc-i/ 



cr" (-Ri) ^i fe cr (Pi). Using the preceding deriva- 
tion and the fact that Pk = a (Pi), we conclude that 
ikQkik+iPk+iO >i k ifePfcO, as required. 

Thus, we have established that ii,...,i m , together with 
Qi , ■ ■ ■ , Qm and Pi, ... , P m , constitute a dispute wheel. ■ 

The preceding lemma reduces the search for a dispute 
wheel to a search for a permutation and a 7r-accepted ranking 
with the stated properties. Observe from (2) that the permu- 
tation g maps the path Pj into the "tail" of the path Ri, in 
applying Lemma 1, we will construct a partial permutation 
by mapping a path Pj into the "tail" of Ri as in (2), and 
then we will complete the permutation by adding nodes to 
the system if necessary so that periodic) = period(cr). We 
use this approach to prove two theorems; the first states that 
if a local verifier accepts at least one ranking that prefers an 
n hop path less than a path of at least n + 2 hops, then the 
verifier is not safe under filtering. 

Theorem 1 Let it be a local verifier. Suppose there exists a 
node i with it -accepted ranking -< j, and two paths Ri, Pi G 
Vf such that length(Pj) > length(p) + 1 and Ri >-$ p. 
Then it is not safe under filtering. 

Proof. The proof relies on Lemma 1 to build a dispute 
wheel. First, using scale invariance of the local verifier, 
we show that the stated conditions of the theorem ensure 
that there exist two paths R\, P[ such that: length(P^) > 



lcngth(P/) + 1; R\ is more preferred than P/ for some tt- 
accepted ranking; and R[ and P/ have no nodes in common, 
other than % and 0. Lemma 2 then completes the proof of 
the theorem through two steps: first, once we have found the 
paths R\ and P[, we use them to build a permutation a such 
that the conditions of Lemma 1 are satisfied; and second, we 
show that the dispute wheel given by Lemma 1 is in fact a 
dispute ring, by checking that no nodes are repeated around 
the wheel. 

We first construct the paths R[ and P[ as described in the 
previous paragraph. Let i, -< $, Ri, and Pj be given as in the 
theorem. Let £ = lcngth(p); i.e., Pi — IU1U2 ■ ■ -Ui-\0. 
We add £ new nodes to the routing system, and label them 
Vi, . . . , Vf, let N' = TV + £. By scale invariance, there exists 
a 7r-accepted ranking -< f on the set of paths Vf with -<i as 
a subranking. For such a ranking xf we have Ri yf Pj. 



But now consider the path Tj 



IV\ . 



.viO; note that 



lengthen) = £+1. Since R t yf P u either T; >-f Pi, 
or P. >-f T t . In the former case, let R\ = T it P[ = P; 
and in the latter case, let R^ = Ri, and P/ = Tj. Then 
length(i^) > lcngth(P/) + 1, R[ yf P[, and R[ and P/ 
have no nodes in common other than i and 0. 

The following lemma uses Lemma 1 to construct a dispute 
wheel. 



Lemma 2 Let tt be a local verifier. Suppose there exists a 
node i with ir-accepted ranking -< j over Vf ' , and two paths 

Ri, Pi € Vf such that: 

1. length(Pj) > lcngth(P) + 1; 

2. Ri >-$ Pi; and 

3. Ri and Pi have no nodes in common other than i and 
0. 

Then there exists a ir-accepted routing system for which there 
exists a dispute ring. 

Proof of Lemma. The proof of this lemma proceeds by 
using scale invariance: we add enough new nodes to the sys- 
tem to allow us to build a permutation such that the condi- 
tions of Lemma 1 are satisfied. The key insight is that we 
initially construct the permutation a by mapping the path 
Pi into the "tail" of the path Ri. We then add enough 
nodes so that when we complete the definition of a, we have 
period^ (a) = period(cr). 

Let lcngth(p) = n, and let h — length(Pj) — n; note 
that, by Condition 1 in the statement of the lemma, we know 
h > 1. Define %\ — i. We label the nodes so that p = 

i\%2 ■ ■ ■ irfi, and Ri = i\X\X2 ■ ■ ■ Xh-iiii2 ■ ■ ■ i«0. We want 
to define a permutation a that will map the path i\ . . . i n 

to the tail of Ri, i.e., to the path i\ . . . i n 0. However, this 
does not completely define a permutation, so we must add 
additional nodes to ensure that periodic) = period(a-). 

We add 2(h— l)+n additional nodes to the system, labeled 
xi, . . . ,Xh-i, andi' 1; . . . ,i' n ,x' x , . . . ,x' h _ 1 . By scale invari- 
ance, we know there exists at least one 7r-accepted ranking 
<i over all paths using this larger set of nodes, such that <i 
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Figure 13: Dispute ring construction for Lemma 2. 

has -<i as a subranking. In particular, since Ri !>-j Pi, we 
have Ri>iPi. We now define a permutation a according to 
the following maps: 



%k 

Xk 



ik - 

Xk 



ik, 
■* Xk- 



k = 1,. 
fc = 1, 



. ,n; 



,/i- 1. 



That is, <j(ik) — ik, &(ik) = i'k> etc - For a ^ n °des j not 
listed, we define a(j) = j. Note that the period of a is 
period(cr) = 3, and of course periodic) = period^ (a) = 
3 = period(cr). Finally, note that by definition of a, we have 

Ri = iQt<T(i)a(Pi)0, where Q t = ix\ . . . Xh-ih- 

Thus, the conditions of Lemma 1 have been satisfied 
by the ranking Aj, the paths Ri and Pi, and the permu- 
tation a; so we know there exists a 7r-accepted routing 
system for which there exists a dispute wheel. To com- 
plete the proof, we need only check that the dispute 
wheel is a dispute ring. Note that the wheel has three 
pivot nodes. Furthermore, to check that no nodes are 
repeated around the wheel, we simply enumerate the 
elements of our dispute wheel: Qi — i\X\ . . .x m -ih', 
c(Qj) = iiibi . . . x m -ii[; cF 2 (Qi) = i[x[ 



Pi = h. . . i„0; a(Pi) = ix . .. i n 0; and <r 2 (Pi 



t[...t' n 0. 

It is straightforward to check that these paths constitute 
a dispute ring: in Figure 13, note that the dispute wheel 
constructed from these paths has no repeated nodes. ■ 

Lemma 2 completes the proof of the theorem: we have 
shown that if some 7r-accepted ranking exists satisfying 
the conditions of the theorem, then using only permutation 
invariance and scale invariance we can build a 7r-accepted 
routing system with a dispute ring. This routing system is 
then unsafe under filtering, by Proposition 2. ■ 

The preceding theorem suggests that local verifiers that are 
safe under filtering are very closely related to the shortest 
hop count verifier, since no rankings can be accepted where 
n hop paths are less preferred than n + k hop paths, for k > 
2. The next theorem draws this relationship even closer, by 
proving that there exists a dispute wheel if a local verifier 
accepts any ranking where an n hop path is less preferred 
than ann+1 hop path. 



Theorem 2 Let n be a local verifier. Suppose there exists a 
node i with it -accepted ranking -<i, and two paths Ri, Pi G 
Vf such that lcngth(Ri) = length(Pj) + 1 and Ri >~i Pi. 
Then there exists a ^-accepted routing system with a dispute 
wheel. 

Proof. As in the proof of Lemma 2, our basic approach is 
to map the path Pi into the "tail" of the path Ri. This par- 
tially defines a permutation a. Using a graphical approach, 
we show how to add nodes to the system and complete the 
permutation a so that periodic) = period(cr). We then ap- 
ply Lemma 1 to conclude there exists a 7r-accepted routing 
system with a dispute wheel. 

To begin, write Ri = ii\ . . . i n 0, and Pj = iv\ . . . v n -\0. 
We will partially define a permutation a, and then add 
nodes and "complete" the permutation so that a satisfies 

the conditions of Lemma 1. For all nodes j g" Ri\JPi, 
we define a(j) = j. Let V = Ri{JPi \ {0} = 
{i, ii, . . . , i nt Vi, ■ ■ ■ , v n -i}; i.e., V is the set of the nonzero 
nodes in Ri |J Pj. We define a directed graph on the ver- 
tex set V, by defining the set of arcs A as follows: A = 
{(Mi)}U{( u fc>Wi) : k = l,...,n-l}. Define the graph 
G = (V,A). 

We can immediately make the following observations 
about G: (1) each node in V has either exactly one outgo- 
ing link and no incoming links; or exactly one incoming link 
and no outgoing links; or exactly one incoming link and ex- 
actly one outgoing link; and (2) from the definition of A, 
node i has exactly one outgoing link and no incoming links. 
We interpret the graph G as a partial representation of the 
permutation a, by defining a(i) = k if (j, k) e A. 

Of course, this only partially defines a, and we now con- 
sider how we should complete the definition of a. Let 
T\ , . . . T m be the disjoint connected components of G; we 
write Tfc = (Vk, Ak). By the definition of "connected com- 
ponent", we know Vk ("I Vy = Ak fl A^ = for k ^ k' . We 
assume without loss of generality that % € V\. 

Our approach is to first define a for all the nodes in each 
connected component T&, for k = 2, . . . , m. From the 
observations above, we can enumerate the nodes in Vk as 
Vk = {ui, «2, • • • , ug], such that each u r has a link to u r+ i, 
for r = 1, . . . ,£ — 1; and either ug has no outgoing links (in 
which case Tk is just a "segment") or ug has a link to u\ (in 
which case Tk is a "cycle"). We define a(u r ) = w r +i> where 
we interpret ug + i as «i. Thus, in a segment or cycle, each 
node is mapped to its successor; in addition, in a segment, 
the last node is mapped to the first node. This defines the 
permutation a for all nodes, except those in V\ . 

To complete the proof, we will add enough nodes and ex- 
tend the definition of a so that periodic) = pcriod(cr); 
we can then apply Lemma 1. Note that for all nodes j e 
V-2 U • • • U V m , we can compute period,- (a) based on the 
preceding definition. Let K be the least common multiple 
of period (er), over all j e V2 U • • • U V m . We then add 
nodes to the system, and in particular to the set V\, until 
|Vi| (i.e., the number of nodes in V\) is a multiple of K. 
Let the nodes added be z\, . . . , z s \ these nodes will eventu- 
ally become the pivots of the dispute wheel. We know that 
A\ must be of the form {(i, i\), (i\, m), . . . , (ui-\, ug)} 
for some nodes u\,...,ui G V. We define a as follows: 
a(i) = i\, cr(ii) = u\, a(u r ) = w r +i, for r = 1, . . . ,£ — 1; 
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a(ue) — z\, <j(z r ) = z r +i, for 1 < r < s — 1; and 
a(z s ) — i. Thus, it is as if we added the nodes z\, . . . , z s , 
and turned the segment 7\ into a cycle. Since the length of 
this cycle is a multiple of K, it is clear that period(cr) is a 
multiple of K, and periodic) = period(cr). 

By scale invariance, even though we have added nodes 
to the system, we can extend -<i to a 7r-accepted ranking 
over the resulting larger set of paths, while maintaining 
the preference of Ri over Pi for node i. Furthermore, 
recalling our initial definition of the arc set A, it is clear 
that we have Ri — ii\ . . . i n — ia(i)a(vi) . . . cr(f„_i)0 = 
icr(i)a(Pi)0. Thus, we can apply Lemma 1, with Qi = 0, 
to conclude there exists a 7r-accepted routing system with a 
dispute wheel. ■ 

The preceding results should not be interpreted as suggest- 
ing that we cannot find a routing system that is safe under 
filtering, where nodes prefer n + k hop paths over n hop 
paths. Indeed, as we know from Example 6, there exist rout- 
ing systems where nodes prefer 3 hop paths over 1 hop paths, 
and yet the system is safe under filtering. However, checking 
whether such systems are safe under filtering requires global 
verification; the theorems we have presented suggest safety 
under filtering cannot be guaranteed through local verifica- 
tion alone, if some nodes are allowed to prefer n + k hop 
paths over n hop paths. 

Furthermore, the preceding two results highlight the im- 
portance of dispute rings in our discussion. Theorem 1 gives 
the strong result that a verifier that allows some n + k hop 
path to be more preferred than an n hop path cannot guar- 
antee safety under filtering, if k > 2. However, Theorem 2 
only guarantees existence of a dispute wheel if a verifier that 
allows some n + 1 hop path to be more preferred than an n 
hop path; and we cannot draw conclusions regarding the sta- 
bility or safety of our system on the basis of a dispute wheel, 
again as pointed out by Example 6. 



7. Conclusion 

This paper has explored the fundamental tradeoff between 
the expressiveness of rankings and routing safety, presum- 
ing that each AS: (1) specifies its rankings independently of 
other ASes and (2) retains complete freedom over filtering. 
We characterize the interactions between filtering and rank- 
ings and present the first systematic study of how filtering 
can introduce instability into a routing system. We show that, 
with ranking independence and unrestricted filtering, guar- 
anteeing the safety of the routing system essentially requires 
each AS to rank routes based on AS path length. 

This paper makes three main contributions. First, we show 
that next-hop rankings are not safe; we also observe that al- 
though rankings based on a globally consistent weighting of 
paths are safe under filtering, even minor generalizations of 
the weighting function compromise safety. Second, we de- 
fine a dispute ring and show that any routing system that has 
a dispute ring is not safe under filtering. Third, we show 
that under ranking independence and unrestricted filtering, 
the set of allowable rankings that guarantee safety is effec- 
tively ranking based on (weighted) shortest paths. 

In light of the results we present, a natural question to ask 
is whether they are positive or negative. In one sense, our 
results are grim, because they suggest that if BGP remains 



in its current form and each AS establishes filters arbitrar- 
ily and specifies rankings autonomously, then the routing 
system will generally be unsafe unless each AS constrains 
its rankings over available paths to those that are consistent 
with shortest hop count (or, alternatively, preferences that are 
based on consistent edge weights). 

On the other hand, our results are positive, because they 
suggest a clear direction forward: BGP must be modified if 
ASes are to filter without restriction and retain ranking in- 
dependence, without compromising routing safety. Our re- 
sults in Section 4.2, which show that routing using prefer- 
ences derived from edge weights is guaranteed to be stable, 
suggest one possibility for modification. Suppose each AS 
ranks paths based on the sum of edge weights to the desti- 
nation and adjusts weights on its incident outgoing edges to 
neighboring ASes. Rankings would then be derived from the 
total path cost, but an AS might still retain enough flexibil- 
ity to control the next-hop AS en route to the destination. 
Such an approach could ensure that the protocol is safe on 
short timescales, while allowing "policy disputes" to occur 
on longer timescales, out-of-band from the routing protocol. 
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